Identity, the gate and the slots
The key is the identity, and it lives on this computer. There is nothing to sign up for and nothing online. An encrypted Ed25519 key file, whose private half only opens on this machine, is what unlocks Vigia. It sits in a folder of its own under Vigia's data folder, sealed under the machine's fingerprint and a password of twelve characters or more: the file opens nothing without the password, and five wrong answers stop the account answering for fifteen minutes. A new account is a name and a password, and the key is made on the spot — nothing is asked of anyone, nothing is sent anywhere. One computer, one account: the door opens it with its password and nothing else — a second account, one from a license, a backup file restored beside it are all refused while an account exists.
Two factors at the door, key first. The gate order is the password (which opens the key), then Touch ID or Windows Hello. The sensor falls back to the account password on a Mac with no sensor or a closed lid, and on a Windows computer where Hello is not set up; the degraded state is always said on screen. Being in is the authentication: the second factor is asked again only before the actions that are hard to undo. Setup → Accessing Vigia can stop asking the sensor — the password alone then opens Vigia and stands in before those actions — and turning it off is confirmed by the sensor first.
An account travels as a file. Setup → Encrypted Backup keeps everything Vigia has under a passphrase of your own (PBKDF2-SHA512 + AES-256-GCM): the servers, groups, snippets and flows, the audit ledger, the licenses, the saved logins with the SSH key files they open with, the certificates and repositories, the database mirrors, the mail server, the startup board and the buckets — not the command history. It is rewritten within a minute of any change, beside the account on this computer and in the folder picked with Choose a Folder… — one that leaves this computer: a USB drive, a NAS share, a folder Dropbox, iCloud Drive or OneDrive keeps in sync; Vigia's own folder is refused. Earlier versions are kept in that folder — one an hour for a day, then one a day for 30 days — and Restore… puts any of them back, always as a full restore of the whole account, with how things are now kept as a version first. Save Backup File… writes one more copy, the key and the backup in one file, anywhere. Restore an account from a backup file, at the door of any computer, brings the account back under a new password: same key, same servers, same vault, same slots. The passphrase cannot be recovered — not by LockFlare, not by anyone.
Accessing Vigia. Setup → Accessing Vigia → Change Password… asks the current password, then reseals the key under the new one on the spot. Nothing else changes.
Vigia server vs terminal. Two kinds of server go on the map. A Vigia server sits on a slot and gets everything Vigia does to a box as root: Security Setup, System Setup, Backups, the tools, the clusters. A terminal sits on no slot and has no count: a box Vigia is a shell to — Files, Tunnels, Snippets, History, everything the login can do by hand. Locked features stay on the rail, marked, and say what they are when pressed — never greyed, never silent. A terminal becomes a Vigia server on Edit the day a slot is picked for it. The shell itself is never refused for a slot.
Slots. Every installation has ten free slots (free:1 to free:10) that never expire. Add a server has Select License Slot: the free slots first — Slot 3 Available — Never expires — then the ones a key added — Slot 12 Available — Expires 2027-10-08 — then No slot — add it as a terminal, and No more licenses available when every slot is taken. Show Used Licenses lists the taken slots with the server on each; picking one for a new box is a replace: Vigia says whose slot it is, asks twice, and the displaced server leaves this computer — its row, its saved login, its tunnels, its open tabs. Edit has the same select. A server on a free slot cannot move to another slot; Remove frees the slot. A server on a paid slot moves to any available slot on Edit.
When a slot runs out. On its day the slot is dead: never offered again, never reused, and the server on it drops to a terminal — nothing is lost, the shell still opens — until it is moved to another slot on Edit. There is no renewal anywhere: new slots are bought, and the server is moved.
The account license (LFA1.). An account at lockflare.com is an email address and nothing else — no password, no name. Add Slots, step 1, opens lockflare.com/license in the computer's own browser: the email goes in, the license comes back — shown the first time, and mailed — and is pasted in Vigia, which opens it with the envelope key built into the app, checks LockFlare's Ed25519 signature locally, and keeps it sealed under the password. That computer is the account from then on. Getting the license again — a reinstall without a backup, a lost computer — takes a six-digit code mailed to that inbox and typed on the page; then the license and every slot key bought for it are shown and mailed. Vigia never verifies the code and never talks to LockFlare: the code only gates the website. A license already in hand works wherever it is pasted — a backup, a second computer — and Vigia does not try to tell those apart. A second license over filed slot keys is refused.
The slot key (LFS1.). Add Slots, step 2, opens lockflare.com/slots: the same email, how many, Stripe. The key carries the account, the slots and the day they run out, signed; pasted in Vigia, every slot in it is listed after the ones there are, numbered on. A key for another account is refused in words, and so is a key pasted before. Setup → Licenses shows the account (the email hint), every key with its slots from–to, its expiry and what is in use, and the slots table — with a text file of them all. A key can be removed only while no server sits on its slots.
Nothing is renewed, nothing is refunded. The ten free slots are the trial. A purchase past them is final; the checkout says so and asks for the tick.
Session lock. Lock Vigia, in the bar at the top, blurs the console past reading and asks for the second factor to come back. The shells stay open, jobs carry on; keystrokes are swallowed at the capture phase so a terminal behind the blur cannot be typed into. Nothing dismisses it but the factor.
Welcome. One branded moment per unlock: what this is, and that you are in. Skippable by any key or click; nothing load-bearing, no "sign in as" language anywhere.